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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .1 36(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment See 37 CFR 1.704(b). 

Status 

1 )IEI Responsive to communication(s) filed on 17 July 2003 . 
2a)D This action is FINAL. 2b)K This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) E3 Claim(s) i-25 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [3 Claim(s) 1-25 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) ^ The specification is objected to by the Examiner. 

10) KI The drawing(s) filed on 17 July 2003 is/are: a)D accepted or b)[3 objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)D All b)Q Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . Claims 1 -25 are pending. 

Claim Objections 

2. Claims 1-8 are objected to because of the following informalities: 

a. Regarding claim 1, line 5 of the page, "detecting" should be replaced with 
"detect". 

Appropriate correction is required. 

Drawings 

3 . New corrected drawings in compliance with 3 7 CFR 1 . 1 2 1 (d) are required in this 
application because the drawings (Figures 1-3)' are handwritten and difficult to read. Applicant 
is advised to employ the services of a competent patent draftsperson outside the Office, as the 
U.S. Patent and Trademark Office no longer prepares new drawings. The corrected drawings are 
required in reply to the Office action to avoid abandonment of the application. The requirement 
for corrected drawings will not be held in abeyance. 

Specification 

4. The use of the trademark WINDOWS PE has been noted in this application. It should be 
capitalized wherever it appears and be accompanied by the generic terminology. 
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Although the use of trademarks is permissible in patent applications, the proprietary 
nature of the marks should be respected and every effort made to prevent their use in any manner 
which might adversely affect their validity as trademarks. 

Claim Rejections - 35 USC § 112 

5. The following is a quotation of the first paragraph of 35 U.S.C. 1 12: 

The specification shall contain a written description of the invention, and of the manner and process of making 
and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it 
pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode 
contemplated by the inventor of carrying out his invention. 

6. Claim 25 is rejected under 35 U.S.C. 1 12, first paragraph, as failing to comply with the 
enablement requirement. The claim(s) contains subject matter which was not described in the 
specification in such a way as to enable one skilled in the art to which it pertains, or with which 
it is most nearly connected, to make and/or use the invention. 

b. Regarding claim 25, the claim is directed to a server detecting malware upon a 
computer by performing steps, including booting. However, the specification (last 3 
paragraphs & Fig. 3) describes the local computer booting and then contacting the server. 
Therefore, the specification does not describe the server booting the local computer such 
that one having ordinary skill in the art at the time the invention was made could make or 
use such a server. 

7. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 
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8. Claims 5-6 13-14, 21-22 & 25 are rejected under 35 U.S.C. 1 12, second paragraph, as 
being indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

c. Regarding claim 5, it is unclear what effect the firewall has on the claim(s), since 
the claim(s) is/are directed to a removable physical media bearing a computer program. 

d. Regarding claims 6, 14 & 22, the claims contain the trademark/trade name 
Windows PE. Where a trademark or trade name is used in a claim as a limitation to 
identify or describe a particular material or product, the claim does not comply with the 
requirements of 3 5 U.S.C. 1 1 2, second paragraph. See Ex parte Simpson, 218 

USPQ 1020 (Bd. App. 1982). The claims scopes are uncertain since the trademark or 
trade name cannot be used properly to identify any particular material or product. A 
trademark or trade name is used to identify a source of goods, and not the goods 
themselves. Thus, a trademark or trade name does not identify or describe the goods 
associated with the trademark or trade name. In the present case, the trademark/trade 
name is used to identify/describe a version of the Windows operating system and, 
accordingly, the identification/description is indefinite. 

e. Regarding claim 13, similarly to claim 5, it is unclear what effect the claim has on 
the previous claims because the firewall does not change the method of claims 9 and 12. 

f. Regarding claims 17-24, the claims are directed to a computer, but method steps 
rather than components are recited. Therefore the claim appears to belong to more than 
one statutory class. This renders the scope of the claim unclear. For the purposes of this 
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Office Action, the preamble is understood to read "A computer comprising a processor 
configured to perform the steps of: ". 

g. Regarding claim 21, similarly to claims 5 & 13, it is unclear what effect the claim 
has on the previous claims because the firewall does not change the computer of claims 
20 and 17. 

h. Regarding claim 25, the claim is directed to a "server computer connected by a 
network link to a computer detecting malware upon said computer by performing the 
steps of . . .". However, it is unclear whether it is the computer or the server computer 
that is performing the steps of detecting malware and the steps of booting, loading, 
downloading and performing malware detection. Further, the claim is directed to a server 
computer, but method steps rather than components are recited. Therefore the claim 
appears to belong to more than one statutory class. This renders the scope of the claim 
unclear. For the purposes of this Office Action, the preamble is understood to read "A 
server computer, comprising a storage device storing one or more malware detection 
files, connected by a network link to a computer comprising a second processor, said 
second computer detecting malware upon said second computer, said second processor 
configured to perform the steps of: It is noted that this type of claim might be more 
appropriately recited as a system claim, the system comprising both the computer and 
server computer. 

9. Any claims rejected under 35 U.S.C. §§102 or 103 below are rejected as best understood 
in light of the rejections under 35 U.S.C. §1 12. Further, any claim depending from a claim 
rejected under 35 U.S.C. §1 12 is rejected based on that dependency. 
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Claim Rejections - 35 USC § 102 

10. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

11. Claims 1-3, 7-1 1, 15-19 & 23-25 are rejected under 35 U.S.C. 102(b) as being anticipated 
by U.S. Patent 6,347,375 to Reinert et al. (Reinert). 

Regarding claim 1, Reinert discloses a removable physical media/CD-ROM (col. 6, line 
66) bearing a computer program/bootable virus utility (col. 6, lines 55-56) operable to control a 
computer to detect malware/viruses by performing the steps of booting said computer with a 
non-installed operating system/bootable virus utility (col. 6, lines 55-61) read from said 
removable physical media/CD-ROM (col. 6, line 66) instead of an installed operating system 
(col. 6, lines 55-61) stored on said computer, loading network support code/communications 
program for said computer read from said removable media/CD-ROM (col. 7, lines 65-67), 
downloading from a remote computer/remote computer 54 one or more malware/virus detection 
files (col. 8, lines 20-25) and performing malware/virus detection upon said computer using said 
one or more malware/virus detection files (col. 8, line 28). 

Regarding claim 2, Reinert discloses wherein said one or more malware detection files 
include at least one of malware definition data/up-to-date virus signature containing data 
characteristic of malware to be detected (col. 8, lines 23-25). 
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Regarding claim 3, Reinert discloses wherein said steps further comprise loading security 
management code/communications program (col. 7, lines 65-67) operable to control 
downloading (col. 8, lines 20-25). 

Regarding claim 7, Reinert discloses an optical disk/CD-ROM (col. 6, line 66). 

Regarding claim 8, Reinert discloses the malware to be detected including a computer 
virus and data file associated with a malware file (signature) (col. 6, lines 55-56 & col. 8, lines 
20-25). 

Regarding claim 9, Reinert discloses booting said computer with a non-installed 
operating system/bootable virus utility (col. 6, lines 55-61) read from said removable physical 
media/CD-ROM (col. 6 3 line 66) instead of an installed operating system (col. 6, lines 55-61) 
stored on said computer, loading network support code/communications program for said 
computer read from said removable media/CD-ROM (col. 7, lines 65-67), downloading from a 
remote computer/remote computer 54 one or more malware/virus detection files (col. 8, lines 20- 
25) and performing malware/virus detection upon said computer using said one or more 
malware/virus detection files (col. 8, line 28). 

Regarding claim 10, Reinert discloses wherein said one or more malware detection files 
include at least one of malware definition data/up-to-date virus signature containing data 
characteristic of malware to be detected (col. 8, lines 23-25). 

Regarding claim 1 1 , Reinert discloses wherein said steps further comprise loading 
security management code/communications program (col. 7, lines 65-67) operable to control 
downloading (col. 8, lines 20-25). 

Regarding claim 15, Reinert discloses an optical disk/CD-ROM (col. 6, line 66). 
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Regarding claim 16, Reinert discloses the malware to be detected including a computer 
virus and data file associated with a malware file (signature) (col. 6, lines 55-56 & col. 8, lines 
20-25). 

Regarding claim 17, Reinert discloses a computer/computer 42 (col. 7, line 60) 
performing the steps of booting said computer with a non-installed operating system/bootable 
virus utility (col. 6, lines 55-61) read from said removable physical media/CD-ROM (col. 6, line 
66) instead of an installed operating system (col. 6, lines 55-61) stored on said computer, loading 
network support code/communications program for said computer read from said removable 
media/CD-ROM (col. 7, lines 65-67), downloading from a remote computer/remote computer 54 
one or more malware/virus detection files (col. 8, lines 20-25) and performing malware/virus 
detection upon said computer using said one or more malware/virus detection files (col. 8, line 
28). 

Regarding claim 18, Reinert discloses wherein said one or more malware detection files 
include at least one of malware definition data/up-to-date virus signature containing data 
characteristic of malware to be detected (col. 8, lines 23-25). 

Regarding claim 19, Reinert discloses wherein said steps further comprise loading 
security management code/communications program (col. 7, lines 65-67) operable to control 
downloading (col. 8, lines 20-25). 

Regarding claim 23, Reinert discloses an optical disk/CD-ROM (col. 6, line 66). 

Regarding claim 24, Reinert discloses the malware to be detected including a computer 
virus and data file associated with a malware file (signature) (col. 6, lines 55-56 & col. 8, lines 
20-25). 
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Regarding claim 25, Reinert discloses a server computer/remote computer 54 (col. 8, 
lines 10-11) connected by a network link to a computer/computer 42 detecting malware upon 
said computer (col. 8, lines 10-1 1) by performing the steps of booting said computer with a non- 
installed operating system/bootable virus utility (col. 6, lines 55-61) read from said removable 
physical media/CD-ROM (col. 6, line 66) instead of an installed operating system (col. 6, lines 
55-61) stored on said computer, loading network support code/communications program for said 
computer read from said removable media/CD-ROM (col. 7, lines 65-67), downloading from a 
remote computer/remote computer 54 one or more malware/virus detection files (col. 8, lines 20- 
25) and performing malware/virus detection upon said computer using said one or more 
malware/virus detection files (col. 8, line 28). 

Claim Rejections - 35 USC § 103 

12. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

13. Claims 4-5, 12-13 & 20-21 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Reinert, as applied to claims 1, 9 & 17 above, in further view of U.S. Patent Application 
Publication 2003/0149887 to Yadav. 

Regarding claims 4, 12 & 20, Reinert lacks the connection to the remote computer being 
secure. However, Yadav teaches that a compute (NDIS) scanning for potential intrusions uses a 
signature database to compare with fl|42) and updates the database with the latest intrusion 
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signatures by contacting a remote computer/SOC fl|42) over a VPN or SSL connection to . 
safeguard the updates (1HJ43-44). Therefore, it would have been obvious to one having ordinary 
skill in the art at the time the invention was made to modify Reinert to connect to the remote 
computer via a secure connection. One of ordinary skill in the art would have been motivated to 
perform such a modification to safeguard the updates, as taught by Yadav (fflf42-44). 

Regarding claims 5, 13 & 21, Reinert lacks explicitly a firewall. However, as best 
understood inasmuch as claims 5, 13 & 21 affect the claim, it is inherent that Reinert's 
communication program's connection (secured, as taught by Yadav) will traverse a firewall. 

14. Claims 6, 14 & 22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Reinert, as applied to claims 1, 9 & 17 above, in further view of U.S. Patent Application 
Publication 2004/01 17414 to Braun et al. (Braun). 

Regarding claims 6, 14 & 22, Reinert lacks wherein the non-installed operating system is 
a Windows PE operating system. However, Braun teaches that WinPE is a platform that 
replaces DOS for operating system deployment containing minimum functionality needed to run 
windows setup, scripts, etc (1[48). Therefore, it would have been obvious to one having ordinary 
skill in the art at the time the invention was made to modify Reinert to use the Windows PE 
maintenance operating system as the platform for the bootable virus utility program. One of 
ordinary skill in the art would have been motivated to perform such a modification because 
Windows PE is a known maintenance operating platform with minimum functionality needed to 
run scripts from a well-known software developer (such as the bootable virus utility program), as 
taught by Braun (1(48). 
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Conclusion 

15. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

i. The Peterson reference is cited for teaching that Windows PE is well known for 
VPN's (1125). 

j. The Hensley reference is cited for teaching that Windows PE is known for limited 
functionality during disaster recover (f7). 

k. The Zimmer reference is cited for teaching a pre-boot or during-OS-bootup virus 
scanner. 

16. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael J. Simitoski whose telephone number is (571) 272-3841. 
The examiner can normally be reached on Monday - Thursday, 6:45 a.m. - 4:15 p.m.. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (571) 272-3799. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



MJS 




November 14, 2006 




TECHNOLOGY CENTER 



